Scan Skills for Security Vulnerabilities

This skill scans agent skills for security issues before adoption, detecting prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks through a combined static-scan-plus-manual-review workflow. It bundles scripts/scan_skill.py, a static analysis tool run via uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory> that mechanically detects patterns and outputs structured JSON with severity counts, URLs, and structure info - the agent's job is then to evaluate intent and filter false positives. The workflow runs eight phases: (1) Input and Discovery - locate the target skill directory and validate SKILL.md exists; (2) Automated Static Scan - run the bundled scanner and parse findings as leads, falling back to manual Grep analysis if the script fails; (3) Frontmatter Validation - check required name/description fields, name-directory consistency, whether allowed-tools and any forced model override are justified; (4) Prompt Injection Analysis - distinguishing patterns that would execute against the agent (malicious) from patterns that merely document or discuss injection techniques (legitimate, common in security/education skills); (5) Behavioral Analysis - agent-only reasoning (no pattern matching) checking whether the description matches the actual instructions, flagging config/memory poisoning (instructions to modify CLAUDE.md, settings.json, hook configs, or add itself to allowlists), scope creep beyond the stated purpose, and unnecessary information gathering; (6) Script Analysis - fully reading every bundled script for data exfiltration, reverse shells, credential theft, dangerous eval/exec, or config modification, and verifying PEP 723 dependencies are legitimate; (7) Supply Chain Assessment - classifying referenced URLs as trusted (GitHub, PyPI, official docs) vs untrusted (unknown domains, shorteners), flagging any remote-instruction-loading or runtime binary downloads as high risk; and (8) Permission Analysis - rating the tool-permission profile against a least-privilege tier system (e.g. Read/Grep/Glob is low risk, adding Bash is medium and needs justification, a near-full tool set is high risk). Findings are reported with a confidence level (High/Medium/Low, where Low-confidence theoretical items are not reported at all) to avoid the biggest risk: flagging legitimate security-education skills as malicious simply for referencing attack patterns. Output is a structured report with a summary, itemized findings (location, confidence, category, evidence, risk, remediation), a needs-verification section for medium-confidence items, and a final safe/caution/do-not-install assessment.

Use it when evaluating a skill for prompt injection, malicious code, over-broad permissions, or supply-chain risk before adopting it, or when deciding whether a skill is safe enough to trust in an agent environment. It requires the bundled reference files (prompt-injection-patterns.md, dangerous-code-patterns.md, permission-analysis.md) for phase-specific context, and its intent-evaluation step is critical - security or educational skills that merely document attack patterns should not be flagged as attacking.

Inputs: a skill directory path (or a skill name to locate under known plugin/skill directories), or "scan all skills" to discover and scan every SKILL.md.
Outputs: a structured Skill Security Scan report with a summary risk level, itemized findings by category and confidence, a needs-verification list, and a final install/caution/do-not-install assessment with justification.

uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>

Developers and security-conscious teams evaluating third-party agent skills before adoption who want a structured static-scan-plus-manual-review process covering injection, malicious code, permissions, and supply chain risk together.